trustedsec / trustedsec/hate_crack

Determine whether hate_crack/main.py's __path__ shim is still needed, now that #276's guard mitigates its footgun

Open
#298 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug
Dominant language
Python
Stars
1.9k
Forks
284
Avg merge
21m
Merged PRs (30d)
14

Description

Context

While fixing #276 (a mock.patch("hate_crack.main.llm.X", ...) string-target patch silently duplicates the llm module for the rest of the pytest session), the fix deliberately left the root cause in place: hate_crack/main.py sets __path__ = [_pkg_dir] so it looks like a package to the import system, which is what lets pkgutil.resolve_name import hate_crack.main.llm as a brand-new module instead of following the real attribute.

#276's fix added a session-wide conftest.py guard (_guard_submodule_identity) that detects and repairs this class of corruption, and converted the 57 known offending call sites — but it did not remove the shim itself, since doing so was out of scope and unverified.

Why the shim might be removable

A probe run during #276 (stripping the __path__ = [_pkg_dir] and __spec__.submodule_search_locations lines from a loaded copy of main.py) succeeded: from hate_crack import llm resolved fine, because a separate sys.path.insert(0, _root_dir) block just above it is what actually makes hate_crack.* imports resolve, and main.py uses no relative imports that would need __path__.

Why it wasn't removed

That probe ran with the package already importable from the repo root. The case the shim plausibly exists for is the installed/E2E load path, where main.py is loaded by path via importlib.util.spec_from_file_location rather than imported as part of the hate_crack package:

  • tests/test_e2e_local_install.py (opt-in, HATE_CRACK_RUN_E2E=1)
  • tests/test_docker_script_install.py (opt-in, HATE_CRACK_RUN_DOCKER_TESTS=1)
  • tests/test_help_before_build.py
  • tests/conftest.py's load_hate_crack_module helper

None of these were exercised during the probe, so whether the shim is load-bearing for that path is genuinely unverified rather than ruled out.

What's needed to close this

  1. Run the two opt-in E2E/Docker suites (HATE_CRACK_RUN_E2E=1, HATE_CRACK_RUN_DOCKER_TESTS=1) with the __path__ shim removed, to see if the by-path load still resolves hate_crack.* submodule imports correctly.
  2. If it still works: remove the shim, which eliminates the #276 footgun at its root — the conftest guard then becomes a pure safety net rather than the only mitigation.
  3. If it breaks: document why the shim is load-bearing (which specific import chain needs submodule_search_locations), so the next person doesn't re-probe from scratch.

Not urgent — the conftest guard fully mitigates the symptom already. This is a root-cause follow-up.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with hate_crack/main.py and the load_hate_crack_module helper in tests/conftest.py, then run tests/test_e2e_local_install.py with HATE_CRACK_RUN_E2E=1 and tests/test_docker_script_install.py with HATE_CRACK_RUN_DOCKER_TESTS=1 after removing the path shim in a test change. Check tests/test_help_before_build.py as well. Done means the by-path install and Docker flows still resolve hate_crack.* imports, or the specific load-bearing import chain is documented.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
testing-qa, tooling
Issue type
Refactor
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
50/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.